Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA3YzktanFocS12cjN2

Remote Code Execution in markdown-pdf

Versions of markdown-pdf prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.

Recommendation

Upgrade to version 9.0.0 or later.

Permalink: https://github.com/advisories/GHSA-p7c9-jqhq-vr3v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA3YzktanFocS12cjN2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 6 years ago
Updated: almost 2 years ago

CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00052
EPSS Percentile: 0.22665

Identifiers: GHSA-p7c9-jqhq-vr3v, CVE-2018-3770
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3770
• https://hackerone.com/reports/360727
• https://github.com/advisories/GHSA-p7c9-jqhq-vr3v
• https://www.npmjs.com/advisories/991

Blast Radius: 14.0

Affected Packages